Stamp Docker image version from the host; flush profiles on error exit (closes #75)

script/docker now computes the version (via script/version), commit and
build date on the host and passes them as build args; the Dockerfile no
longer runs git, which always returned "unknown" because the build
context excludes .git. A dirty tree is reflected through script/version's
-dirty suffix.

main now exits via os.Exit(run()), so its deferred CPU/heap profile
writers flush before the process ends, and Entry returns a status code
instead of calling os.Exit. Each command ran its operation in an fx
goroutine that called os.Exit(1) on failure, discarding those profiles
and the PID-lock release; they now route the error to the return path
through one RunOperation helper. errReported keeps Entry from printing an
already-reported failure twice.

model: claude-opus-4-8

internal/cli/entry_prune_json_test.go

@@ -81,7 +81,7 @@ func TestEntryPruneJSONStdoutIsExactlyOneDocument(t *testing.T) {
 				programName, flagConfig, configPath, cmdPrune, flagJSON,
 			}
 
-			stdout := captureProcessStdout(t, Entry)
+			stdout := captureProcessStdout(t, func() { _ = Entry() })
 
 			requireExactlyOneJSONDocument(t, stdout)